must enter its number.
Syntax:
a) IP Address
Extended Access List #>entry <id> destination address <address> <mask>
b) Interface
Extended Access List #>entry <id> destination address interface <interface>
Example:
a) IP Address
Extended Access List 100>entry 3 destination address 192.168.4.5 255.255.255.255
Extended Access List 100>
Extended Access List 100>entry 4 destination address 192.0.0.17 255.0.0.255
Extended Access List 100>
b) Interface
Extended Access List 100>entry 3 destination address interface serial0/0
Extended Access List 100>
Caution
Since configuring an interface as destination is currently not an option for the rest of protocols and fea-
tures, it should not be done.
2.5.2.5.2 ENTRY <id> DESTINATION PORT-RANGE
The meaning of this command depends on the type of protocol used in the packet that’s being filtered.
• If the packet corresponds to TCP or UDP, this command establishes the sentence for the packet destination port. It
must be followed by two numbers. The first indicates the port identifier in the lower port range and the second is
the identifier in the higher port range. If you do not want a range, simply enter two equal values. Both port identifi-
ers can take values between 0 and 65535.
In this case, the aim of this command is to grant or deny access to various TCP or UDP destination ports.
• If the packet corresponds to the ICMP protocol and the entry is configured to carry out filtering over this protocol
(using command entry <id> protocol icmp), this command establishes the sentence for the ICMP packet code.
This must be followed by two numbers used to specify a range. The first indicates the type of ICMP message used
as the lower range limit, while the second indicates the higher range limit. If you don’t want to establish a range,
simply enter two equal values.
In this case, the aim of this command is to grant or deny a code for ICMP messages or a set of codes. When used
together with the entry <id> source port-range <limit_inf> > <limit_sup> command, specifying the type and code
of ICMP messages you want to filter becomes possible.
Please note that ICMP in the entry can only be configured using the entry <id> protocol icmp command.
• If this command is configured, then a packet is only a match if it complies with all of the above.
Syntax:
Extended Access List #>entry <id> destination port-range <lower_port> <higher_port>
Example 1:
Extended Access List 100>entry 3 destination port-range 2 4
Extended Access List 100>
This entry matches all TCP or UDP packets whose destination port is between 2 and 4 (included).
Example 2
:
Extended Access List 100>entry 3 protocol icmp
Extended Access List 100>entry 3 source port-range 3 3
Extended Access List 100>entry 3 destination port-range 1 5
Extended Access List 100>
bintec elmeg
2 Configuration
Access Control
17
